PT-2023-7026 · Unknown · Intergard Sgs

Hiagomoura · Published 2023-07-19 · Updated 2024-05-17 · CVE-2023-3761

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intergard SGS version 8.7.0

Description A vulnerability was found in the Password Change Handler component, leading to cleartext transmission of sensitive information. The attack can be launched remotely, with a rather high complexity and difficult exploitation. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For Intergard SGS version 8.7.0, consider disabling the Password Change Handler component until a patch is available to prevent cleartext transmission of sensitive information. Restrict access to the Password Change Handler functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2023-08048

CVE-2023-3761

Affected Products

Intergard Sgs

References · 11

• 🔥 https://youtu.be/bMJwSCps0Lc · Exploit
• https://osv.dev/vulnerability/CVE-2023-3761 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3761 · Security Note
• https://bdu.fstec.ru/vul/2023-08048 · Security Note
• https://t.me/cvenotify/54638 · Telegram Post
• https://vuldb.com/?ctiid.234446 · Note
• https://t.me/cvenotify/54613 · Telegram Post
• https://vuldb.com/?id.234446 · Note
• https://youtube.com/watch?v=bMJwSCps0Lc&ab_channel=HiagoMoura · Note
• https://youtube.com/watch?v=bMJwSCps0Lc&ab_channel=HiagoMoura · Note
• https://t.me/cibsecurity/66997 · Telegram Post